FR2808353A1 - REDUNDANT INPUT / OUTPUT MANAGEMENT DEVICE, IN PARTICULAR COMPUTER ROUTING - Google Patents

Abstract

The disclosure relates to a device with built-in redundancy for input/output management, notably a data routing system. The device includes first management means and second management means connected to each other via two interfaces, one a network and the other a standby line, said means mutually exchanging polling messages via these two interfaces, said first means being considered to be defective by said second means when they no longer sends messages during a given time interval on at least one of said two interfaces, characterized in that it includes at least one algorithm to reset said first and second means, the defective means being deactivated and the other means activated during the reset after detection of a failure. The device is applicable to the handling of air traffic data and, more generally, to all digital data input/output management systems necessitating a high level of operational reliability without an excessive cost premium.

Description

The present invention relates to a management device

  redundant I / O, including a computer routing system.

  It applies in particular to the processing of air traffic management information. More generally, it applies to all digital data input and output management systems requiring a large

  dependability without excessive cost.

  The density of air traffic has reached a very high level. In addition, aviation safety requirements are constantly increasing. One consequence of this situation is that air traffic management must process a large amount of information, intended in particular for air traffic controllers and aircraft pilots. This information relates in particular to a broad category of radar data, to meteorological situations, to flight plans or to ILS type data

  regarding landing systems.

  The processing of this information can only be done by powerful computer means. Among these means, an essential role is played by the means of interfacing of the various information or decision centers. These interfacing means in particular have a function of routing information, they therefore in particular have a function of routing data to the correct destination centers. Given the very large flows of data involved, these means have an essential role for the overall good functioning of an air traffic management system. The data processed include radar data and other data relating to the flight situation of aircraft, such as, for example, flight plans or

weather information.

  There are known and in particular commercially available materials, equipped with their operating systems, which make it possible to meet these routing needs. As an example, we can cite a range of products known by the trademark LINES from

  the English expression "Link Interface Node for External Systems".

  These modular products are designed to allow the routing and processing of I / O messages among incoming or outgoing serial lines and Ethernet. Standard serial lines such as for example X25, HDLC or BSC are treated as well as dedicated lines, such as for example protocols for transmitting particular radar information. These routers can operate with a software architecture of the front processor type. They are equipped with FPBSS type software, the latter term coming from the Anglo-Saxon expression "Front Processor Basic System Software". In this embodiment, the router is linked to a single application program. It only has an upstream function, for example the routing of data to the right destination. The whole heart of the application is in one or more central computers. In others

  terms, you need as many routers as there are applications.

  A more efficient use of these routers can be done according to an open communication mode, also called OCP according to the English expression "Open Communication Processor". In this mode, a router is connected to several applications and functions essentially like a data server. In particular, it makes it possible to route and process data from any entry point to any exit point. This operating mode is particularly well suited to air traffic management. In an air traffic control management application,

  this mode in fact allows the following functionalities in particular,

  say: - a black box type distribution of radar data to the centers, the radar data being received by serial interfaces and transmitted via a local network, for example Ethernet, to a group of identified machines, broadcasting also called UDP multicast in the Anglo-Saxon literature; - an autonomous conversion of messages or protocols, allowing in particular the conversion of format of message or specific protocols, thus for example ISR2 in ASTERIX, X25 in iDLC-UI. ..; - a line control function in radar systems, i.e. the transmission of radar data by lines

  series to the processing circuits.

  In an air traffic management type application, the operational safety of computer systems, and therefore of routing systems, is of primary importance, since passenger safety is indeed at stake. For example, the standards of Safety requirements require that the air cover of an air traffic control center should not be interrupted for more than a few seconds per year. It is therefore necessary to resort to redundancy techniques, that is to say in particular to duplicate the equipment so that one of them can replace the other in the event of failure. Typically, each router is duplicated o10. A problem to be solved is the transition from one router to another, when the first fails. A known solution consists in providing an active router, called master, and an inactive router, called slave, with a

  third-party system that arbitrates the transition from execution from master to slave.

  This solution is not economical, in particular because of the use of a

  third-party system, which is added to the redundant router.

  To make the system economic, it is possible to remove the arbitrator. An exchange protocol is then provided between the master and the slave. In particular, when the master becomes faulty, the slave no longer receives messages. The slave then takes over. However, there are degraded modes, in particular where the master degrades the data processed without him knowing it. The master not knowing that he is faulty does not deactivate his inputs / outputs. The slave, on the other hand, knows that the master has failed but is then unable to take control of the routing correctly, in particular because the master has not deactivated its input / output ports. The system continues to operate in degraded mode. It

  the result is a worrying deterioration in dependability.

  An object of the invention is to reduce the costs related to dependability, by eliminating the use of a third-party arbitration system, and this without degrading the dependability whatever the types of input ports. /exit. To this end, the invention relates to a device for managing digital data inputs and outputs, characterized in that it comprises first management means and second management means linked to one another. by two interfaces, a network and a safety line, these means mutually exchanging interrogation messages by these two interfaces, means being considered to be faulty by the other means when they do not transmit any message in a given time interval on at least one of the two interfaces. The input and output management means can be

  routers or data servers.

  At start-up, the first means have for example the role of master and the second means the role of slave, the master managing the input and output data. To ensure redundancy, the means have the same functions and include the same software and same configuration files. When means are detected as being faulty by the other means, the latter deactivate the faulty means, for example. The slave can then take over data management at

the place of the master.

  Advantageously, the interrogation messages, the frequency of sending of these messages, the time limit between two messages are implemented in a configuration file contained in each of the means, several types of these parameters being stored as a function of given applications. Thus, application-specific settings can be

  unloaded in a random access memory during the initialization of the device.

  The main advantages of the invention are in particular that it adapts to many applications and that it is simple to implement.

artwork.

  Other characteristics and advantages of the invention will appear

  with the aid of the description which follows made with reference to the appended drawings which

  represent: - Figure 1, an example of redundant routing system in the case where the input and output ports are of the serial type; FIG. 2, an example of redundant routing comprising a communication network, of the Ethernet type, with client stations. FIG. 1 shows an example of a redundant routing system in the case where the input / output ports are of the serial type. The system comprises a router 1 having the function of master and a router 2 having the function of slave. These two routers have the same functions and include the same software and the same configuration files. The same port 3 of each router communicates by a serial link with the same system 4, for example a modem. For this purpose, the connection between the latter and the two routers is via a cable at y 5. A

  safety bus 6 connects the two routers 1, 2.

  When the two routers 1, 2 start together, the master 1 activates its electrical modes on its input / output ports 3 while the slave 2 leaves its ports 3 inactivated, that is to say in the state of high impedance. This means that even if the two routers are configured, only the master 1 exchanges with the modem 4. In the event of failure of the master, two cases can notably occur: - the master resets to zero or "reset" by putting its ports 3 in the high impedance state and becomes itself a slave, at the same time, slave 2 becomes master and its ports are electrically activated, this is the normal situation and simple to manage; - the master becomes faulty, but does not "reset", the slave knows that he should become master, but the current master does not deactivate his ports, so there is no switching from one router to another due to a potential conflict between ports 3 of the two

  routers, this is the most complex situation to manage.

  The second situation must however be resolved because it dangerously affects operational safety. In this mode of

  operation, the master can indeed process or route false data.

  To deal with this problem, provision is made in particular for the security bus 6 connected between the two routers and intended to send it a "reset" command, that is to say a command to deactivate its ports 3, this command

  being sent by the slave. The latter can then regain control.

  The type of redundancy architecture illustrated in Figure 1 is well suited when the input / output ports involved are serial ports. It is not the same any more when the router exchanges by a local network, called LAN in the Anglo-Saxon literature according to the expression "Local Area Network", for example Ethernet. FIG. 2 illustrates an exemplary embodiment of a device according to the invention. It is a computer routing system comprising two routers 1, 2, one of which is master and the other slave. These two routers operate in OCP open mode. The device being redundant, the two routers then have the same functions, and in particular the same software and same configuration files. Similarly, the inputs and outputs

  to other systems are redundant.

  The two routers are for example connected by a network 23, for example Ethernet or Internet, to one or more remote client systems 21, 22. They are moreover connected to other systems, for example modem, by serial links. A cable at y 5 connects the same port 3 of each router to the same system, in particular so that these two ports 3 can exchange with this system. When the master is active, its serial port is activated while that of the slave is inactive, for example

in the high impedance state.

  The two routers are linked together by the network 23, for example Ethernet or internet, and by a security line 24, for example a bus. By way of example, an Ethernet network 23 is considered. At startup, or when the device is initialized, a router 1 is master and the other 2 is slave. It is the master who then manages the input and output data, and therefore routes them. During operation, the two routers 1, 2 mutually exchange interrogation messages, also called "polling messages" in the Anglo-Saxon literature. These

  interrogation messages are for example exchanged cyclically, i.e.

  say at regular time intervals. They are exchanged by the Ethernet network 23, for example by a broadcast of the UDP unicast type. Of

  interrogation messages are also exchanged by the safety link 24.

  A device according to the invention therefore comprises at least two interfaces for exchanging interrogation messages, a network interface, for example Ethernet, and a communication bus 24. An interrogation message is sent by the slave to the master for check that the master is in good working order, to check that it is not faulty. To this end, the master must respond to this message. All types of interrogation messages can be used. The easiest way is, for example, to send the master a given message and check that it sends it in full. For its part, the master for its part sends interrogation messages to the slave to verify that the latter is also in working order. So there is a supervision of

  two materials 1, 2 without the help of third-party equipment.

  When slave 2 does not receive at least one interrogation message in a given time interval on at least one of the two interfaces, Ethernet 23 or the safety link 24, its program considers that the master has failed. The slave then decides to become master. To this end, it activates the switching mechanism. This switching mechanism can have several components. It includes an algorithm, implemented for example in both the master and the slave, which forces the master to reset, more particularly to re-initialize. This algorithm is also programmed so that during this reinitialization, the slave takes control, therefore becomes active in data processing, while the master remains inactive. This algorithm also provides for the deactivation of the input / output ports of the master and the activation of the input / output ports of the slave become master. A supervision station 25 makes it possible, for example, to read reports of breakdowns or failures sent by the master or the slave. This station 25 can also be used for other functions within the general framework of the application. The device includes, for example, alert means to prevent a failure,

  so that faulty equipment is replaced within the prescribed time.

  The algorithm which forces the reset of the master, and finally its deactivation, is implemented in the master, but it is activated by the slave. To this end, the slave obtains the memory address of this algorithm. Preferably and symmetrically, the algorithm is also installed in the slave, for reasons of standardization of production of the materials, but also so that the master can completely deactivate the slave in the event of failure of the latter. The reset algorithm, its address, the interrogation messages, the frequency of sending these messages, the time limit between two messages before switching, as well as other configuration parameters are notably implemented in a configuration file. contained in each router. Several types of these parameters can be stored in this configuration file, each type depending on the type of final application. When the routers are initialized, the parameters specific to an application are for example downloaded into a random access memory. The management of the different software layers, including the reset algorithm, as well as the communications between these layers are conventionally handled by an operating system, possibly associated with intermediate software layers, called "middleware" in the English literature. Saxon, established in routers. The invention has been described for a computer routing device, a router being associated with a redundant router. The invention can of course be applied to other means of input / output management, such as for example data servers. It advantageously applies to all types of applications requiring high operational reliability with savings requirements. In addition, it is simple to implement,

  since this implementation is essentially software.

Claims (15)

  1. Device for managing digital data inputs and outputs, characterized in that it comprises first management means (1) and second management means (2) connected to one another by two interfaces , a network (23) and a security line (24), these means mutually exchanging interrogation messages by these two interfaces (23, 24), means (1) being considered to be faulty by the other means (2) when they do not send a message in an interval   o10 of time given on at least one of the two interfaces (23, 24).   2. Device according to claim 1, characterized in that at the initialization of its operation, the first means (1) have the role of master and the second means (2) have the role of slave, the master managing the input and output data.   3. Device according to any one of the claims   above, characterized in that the means (1, 2) are connected by the   network (23) to one or more systems (21, 22).   4. Device according to any one of the claims   previous, characterized in that they are connected by one or more serial links to systems, a y-cable (5) connecting the same port (3) of each router to a system.   5. Device according to any one of the claims   above, characterized in that the means (1, 2) have the same functions and include the same software and the same configuration files.   6. Device according to any one of the claims   above, characterized in that when means (1) are detected as being faulty by the other means (2), the latter deactivate the failing means.   7. Device according to claims 2 and 6, characterized in that   the defective means (1) being the master, the slave deactivates the   inputs / outputs of the master and activates its own inputs / outputs.   8. Device according to any one of the claims   above, characterized in that it comprises at least one algorithm for resetting the means (1, 2), the faulty means (1) being deactivated and the other means (2) activated when resetting after detection of a failure.   9. Device according to any one of claims   previous, characterized in that the interrogation messages, the frequency of sending of these messages, the time limit between two messages are implemented in a configuration file contained in each of the means (1, 2), several types of these parameters being stored in function of given applications.   10. Device according to claim 9, characterized in that at the initialization of the means (1, 2), the parameters specific to an application   are unloaded in a random access memory.   11. Device according to any one of the claims   above, characterized in that it includes alert means for warn of a failure.   12. Device according to any one of claims   above, characterized in that the network is a local digital network.   13. Device according to any one of claims   previous, characterized in that the data management means   I / O are computer routers.   14. Device according to claim 13, characterized in that the   routers operate in OCP open mode. he   15. Device according to any one of claims 1 to 12,   characterized in that the input / output data management means are data servers.